This English text is the original. Translations are provided for convenience; if they differ, this text prevails.
This policy explains what personal data Still Beating processes when you play it on Android, why, for how long, who receives it and how to use your rights. The privacy notice of the studio website covers the website itself.
Who is responsible
JFR Studio makes the game and is the controller of the personal data described here. You can reach us at the email address below.
Each item below lists the data, why we use it, the legal basis, how long it is kept and who receives it.
Game data on your device
Data
Your progress, settings, items and the other information the game needs to continue where you left off.
Purpose
To save your game between sessions.
Legal basis
Performance of our contract with you: providing the game you asked for (GDPR art. 6(1)(b)).
How long
Until you erase it in the game or uninstall the game. If Android backup is on for your device, Android may copy this data to the backup in your Google account, which Google keeps under your account settings; we cannot access it.
Who receives it
Nobody: it stays on your device.
Game account
Not active in the current version of the game. It is described so that you know what will happen when we switch it on; we will update the effective date when we do.
Data
A random account identifier that Firebase Authentication creates when you first use the online features, the sign-in tokens that keep you signed in on your device and the IP address of sign-in requests.
Purpose
To link your progress, purchases and online activity to you and to protect the online features against abuse.
Legal basis
Performance of our contract with you: providing the game you asked for (GDPR art. 6(1)(b)).
How long
Until you delete your account. Firebase Authentication keeps the IP addresses of sign-in requests for a few weeks.
Not active in the current version of the game. It is described so that you know what will happen when we switch it on; we will update the effective date when we do.
Data
Your daily runs (score, taps and the run details needed to verify them), the country of your device's region setting, the display name you choose, the groups and duels you join, and counts of game events.
Purpose
To verify and rank runs, to show your display name and scores to the members of your groups and duels, and to publish statistics per country that never identify a player (only for countries with at least 200 runs).
Legal basis
Performance of our contract with you: providing the game you asked for (GDPR art. 6(1)(b)). Our legitimate interests in running, securing and improving the game, balanced against your rights (GDPR art. 6(1)(f)).
How long
Until you delete your account; your name and scores leave a group when you leave it. Anti-abuse counters expire after 24 hours. Country statistics contain no identifiers and are kept.
Not active in the current version of the game. It is described so that you know what will happen when we switch it on; we will update the effective date when we do.
Data
The product you buy and the purchase details that Google Play returns to the game. We never see your payment card or other payment details.
Purpose
To deliver and restore what you buy, handle refunds and prevent fraud.
Legal basis
Performance of our contract with you: providing the game you asked for (GDPR art. 6(1)(b)). Compliance with our legal obligations (GDPR art. 6(1)(c)).
How long
On your device until you uninstall the game. The store keeps your purchase history in your account.
Not active in the current version of the game. It is described so that you know what will happen when we switch it on; we will update the effective date when we do.
Data
The advertising identifier of your device, IP address, device and app information, the ads you see and tap, and your consent choices, which Google’s consent form stores on your device.
Purpose
To show ads, including optional ads that give in-game rewards, to measure them and to prevent ad fraud. Ads are personalised only if you agree in Google’s consent form; otherwise Google shows non-personalised or limited ads.
Legal basis
Your consent, which you can withdraw at any time (GDPR art. 6(1)(a)).
How long
Google keeps advertising data under its own retention periods (policies.google.com/technologies/retention). Your consent choices stay on your device until you change them or uninstall the game.
Performance of our contract with you: providing the game you asked for (GDPR art. 6(1)(b)).
How long
The game keeps no copy; the app you share with handles it under its own terms.
Who receives it
Nobody: it stays on your device.
Support messages
Data
Your email address, your message and anything you attach, such as screenshots or a diagnostic report you choose to send.
Purpose
To answer you, solve your request and handle requests to exercise your rights.
Legal basis
Our legitimate interests in running, securing and improving the game, balanced against your rights (GDPR art. 6(1)(f)). Compliance with our legal obligations (GDPR art. 6(1)(c)).
How long
While we handle your request and afterwards only as long as needed to answer follow-up questions or to defend legal claims.
You can also withdraw consent by writing to [email protected]. Withdrawing consent does not affect processing that happened before.
Your device settings let you reset the advertising identifier, turn off personalised ads and revoke permissions such as notifications.
Children
The game is for players aged 16 and over and is not directed at children. We do not knowingly collect data from anyone under 16; if you think a child has given us personal data, write to us and we will delete it.
16 is the highest age at which any EU country lets you consent alone to optional processing, so the game asks for no age and relies on no parental consent.
Who receives data
We share data only with the companies below, and only for the purposes described above.
Google Firebase: Google LLC and Google Ireland Limited provide our servers, database and app services through Firebase and Google Cloud, as our processor under the Firebase Data Processing and Security Terms. https://firebase.google.com/support/privacy
Google Play: Google distributes the game and provides the Google Play services it uses, such as payments, Google Play Games or the rating window, as an independent controller under its own privacy policy. https://policies.google.com/privacy
Google AdMob: Google shows and measures ads and runs the consent form (User Messaging Platform). For advertising Google decides how it uses the data, as an independent controller under its own policies. https://policies.google.com/technologies/ads
Our processors may handle data outside the European Economic Area, mainly in the United States. Google LLC is certified under the EU–U.S. Data Privacy Framework, which the European Commission found adequate on 10 July 2023, and Google’s terms add the Standard Contractual Clauses approved by the Commission.
Firebase Authentication processes account data in the United States.
Cloud Firestore stores your server data in a Google Cloud data centre in Belgium (europe-west1).
The Cloud Functions that handle requests to our server run in Belgium (europe-west1).
Messages you email us are stored by Gmail, which may keep them in the United States; Google LLC is certified under the EU–U.S. Data Privacy Framework.
Your rights in the EU, EEA and UK
Access your personal data and receive a copy.
Correct inaccurate data.
Delete your data.
Restrict processing.
Receive the data you gave us in a portable format.
Object to processing based on our legitimate interests.
Withdraw your consent at any time.
To use these rights, write to [email protected]. We answer within one month and may ask for information that shows the data is yours.
If you think we have not handled your data lawfully, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the data protection authority where you live or work.
We do not make decisions about you based solely on automated processing.
US state privacy rights
If you live in California, Colorado, Connecticut, Texas, Virginia or another US state with a consumer privacy law, you also have the rights below over the personal data this policy describes.
Know which personal data of yours we process and access it, with a copy.
Correct inaccurate personal data.
Delete the personal data you gave us or that we collected about you.
Opt out of the sale of your personal data and of its sharing or use for targeted advertising (advertising based on your behaviour across different services).
Not be treated unfavourably for using your rights: we do not deny you the game, charge you different prices or lower the quality of the service because of it.
We do not sell your personal data.
Under some state laws, advertising can count as “sharing” personal data for targeted advertising. Where a game shows ads through Google AdMob, Google’s consent form (User Messaging Platform) shows players in these states a message with a choice to opt out of the sale or sharing of their personal data.
If you use that choice, Google limits how it processes your data for ads (restricted data processing) and we honour your decision. You can open the form again at any time from the game’s Settings, where the game offers it, or by writing to us.
To use these rights, write to [email protected]. We confirm that we received your request, may ask for information that shows the data is yours and answer within 45 days (we may extend this once by another 45 days if we tell you why). An authorised agent may also write on your behalf.
If we decline your request and you disagree, reply to our message to appeal and we will answer within 45 days. If you are still not satisfied, you can contact the attorney general of your state.
Brazil (LGPD)
If you are in Brazil, Brazilian Law 13.709/2018 (the General Data Protection Law, LGPD) applies to the personal data this policy describes. JFR Studio is the controller, and our contact for requests from data subjects is [email protected].
Confirmation that we process your data, and access to it.
Correction of incomplete, inaccurate or outdated data.
Anonymisation, blocking or deletion of unnecessary or excessive data, or of data processed unlawfully.
Portability of your data to another provider, on request.
Deletion of data processed with your consent.
Information about the public and private entities we share data with (see the list of recipients above).
Information about the possibility of not giving consent and the consequences of refusing.
Withdrawal of your consent at any time.
We process data on the legal bases of art. 7 of the LGPD that match those listed for each item above: your consent, performance of a contract, our legitimate interests and compliance with legal obligations.
Our processors handle data outside Brazil, mainly in the United States. We transfer it only under a mechanism that the LGPD allows for international transfers, such as standard contractual clauses, and you can ask us for information about it.
To use these rights, write to [email protected]. We answer within 15 days.
You can also complain to the Brazilian National Data Protection Authority (ANPD).
Do you have to give us data?
No law requires you to give us data. The game needs the data marked with the contract basis to work; without your consent, the optional processing simply does not take place.
Deleting your data
Data deletion explains how to delete your game account and which data is deleted or kept. Uninstalling the game deletes the data stored on your device.
Security
Data travels encrypted (HTTPS) and Google stores it encrypted. Our server rules let each account read and write only its own data, and only the studio can manage our cloud projects.
Changes to this policy
We update this policy when the game or the law changes and change the effective date at the top. If a change affects how we use your data, we tell you in the game or on its store page before it applies and ask for your consent again where the law requires it.